CVE-2025-14906: 
WordPress vulnerability analysis and mitigation

CVE-2025-14906 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP Youtube Video Gallery plugin for WordPress, affecting all versions up to and including 1.0. The flaw allows unauthenticated attackers to modify plugin settings by tricking a site administrator into clicking a malicious link. It was published on January 24, 2026, and assigned by Wordfence. The CVSS v3.1 base score is 4.3 (Medium) (Wordfence).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery) and stems from missing nonce verification in the wpYTVideoGallerySettingSave() function within the plugin's admin interface (admin/admin.php, line 444). Because WordPress nonces are not validated before processing settings changes, an attacker can craft a forged HTTP request that, when triggered by an authenticated administrator, causes the server to accept and apply unauthorized configuration changes. No privileges are required on the attacker's part; the only precondition is that a logged-in administrator can be socially engineered into interacting with a malicious link or page (Wordfence, Plugin Source).

Successful exploitation allows an unauthenticated attacker to modify the WP Youtube Video Gallery plugin's settings on the affected WordPress site, resulting in a low integrity impact with no direct effect on confidentiality or availability. Potential consequences include injecting malicious YouTube gallery configurations, redirecting video content, or altering plugin behavior in ways that could facilitate further attacks such as content spoofing. The scope is limited to the plugin's settings and does not directly grant code execution or access to sensitive data (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.023%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering of a site administrator, which limits its practical attack surface (Wordfence).

1. Reconnaissance: Identify WordPress sites running the WP Youtube Video Gallery plugin version 1.0 or earlier, using tools like WPScan or by inspecting publicly accessible plugin metadata.
2. Craft malicious request: Create a forged HTML form or URL that submits a POST request to the plugin's settings-save endpoint (invoking wpYTVideoGallerySettingSave()), with attacker-controlled parameter values and no valid nonce.
3. Social engineering: Deliver the malicious link or auto-submitting HTML page to a site administrator via email, forum post, or other channel, inducing them to click or visit it while authenticated to the WordPress admin panel.
4. Settings modification: Upon the administrator's interaction, the forged request is processed by the server without nonce validation, applying the attacker's desired plugin settings changes to the site (Wordfence, Plugin Source).

• Logs: WordPress admin action logs showing unexpected changes to WP Youtube Video Gallery plugin settings, particularly from sessions where the administrator did not intentionally access the plugin settings page.
• Network: HTTP POST requests to the WordPress admin endpoint associated with wpYTVideoGallerySettingSave() originating from unusual referrers or external domains.
• Application: Unexpected or unauthorized changes to plugin configuration values (e.g., altered YouTube API keys, gallery display settings) without corresponding administrator activity.

The primary remediation is to update the WP Youtube Video Gallery plugin beyond version 1.0 once a patched release is available from the plugin author. In the interim, administrators should consider deactivating or removing the plugin if it is not essential. General WordPress hardening measures — such as using security plugins that enforce nonce checks, limiting admin account exposure, and training administrators to avoid clicking unsolicited links — can reduce the risk of CSRF exploitation (Wordfence).